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Abstract — Recent results have shown that lattice codes can be 
used to construct good channel codes, source codes and physical 
layer network codes for Gaussian channels. On the other hand, 
for Gaussian channels with secrecy constraints, efforts to date 
rely on random codes. In this work, we provide a tool to bridge 
these two areas so that the secrecy rate can be computed when 
lattice codes are used. In particular, we address the problem of 
bounding equivocation rates under nonlinear modulus operation 
that is present in lattice encoders/decoders. The technique is 
then demonstrated in two Gaussian channel examples: (1) a 
Gaussian wiretap channel with a cooperative jammer, and (2) 
a multi-hop line network from a source to a destination with 
untrusted intermediate relay nodes from whom the information 
needs to be kept secret. In both cases, lattice codes are used to 
facilitate cooperative jamming. In the second case, interestingly, 
we demonstrate that a non-vanishing positive secrecy rate is 
achievable regardless of the number of hops. 

I. Introduction 

Information theoretic secrecy was first proposed by Shan- 
non in HI. In this classical model, Bob wants to send a 
message to Alice, which needs to be kept secret from Eve. 
Shannon's notion of secrecy requires the average rate of 
information leaked to Eve to be zero, with no assumption 
made on the computational power of Eve. Wyner, in J2), 
pointed out that, more often than not, the eavesdropper 
(Eve) has a noisy copy of the signal transmitted from the 
source, and building a useful secure communication system 
per Shannon's notion is possible J2). Csiszar and Korner 
extended this to a more general channel model. 

Numerous channel models have since been studied under 
Shannon's framework. The maximum reliable transmission 
rate with secrecy is identified for several cases including 
the Gaussian wiretap channel [4j and the MIMO wiretap 
channel 0, J6), Q. Sum secrecy capacity for a degraded 
Gaussian multiple access wiretap channel is given in (8). 
For other channels, upper bounds, lower bounds and some 
asymptotic results on the secrecy capacity exist. For the 
achievability part, Shannon's random coding argument proves 
to be effective in majority of these works. 

On the other hand, it is known that the random coding 
argument may be insufficient to prove capacity theorems for 
certain channels (9). Instead, structured codes like lattice 
codes are used. Using structured codes has two benefits. First, 
it is relatively easy to analyze large networks under these 
codes. For example, in iflOl . ifTTl . the lattice code allows the 
relaying scheme to be equivalent to a modulus sum operation, 
making it easy to trace the signal over a multi-hop relay 



network. Secondly, the structured nature of these codes makes 
it possible to align unwanted interference, for example, for 
the interference channel with more than two users lfl2l . |fl3l , 
and the two way relay channel IflOl . IfTTl . 

A natural question is therefore whether structured codes 
are useful for secure communication as well. In particular, in 
this work, we are interested in answering two questions: 

1) How do we bound the secrecy capacity when structured 
codes are used? 

2) Are there models where structured codes prove to be 
useful in providing secrecy? 

Relevant references in this line of thinking includes lfl4l 
and 03). Reference lfT4l considers a binary additive two- 
way wiretap channel where one terminal uses binary jamming 
signals. Reference |fT31 examines a wiretap channel where the 
eavesdropping channel is a modulus-A channel. Under the 
proposed signaling scheme therein, the source uses a lattice 
code to convey the secret message, and, the destination jams 
the eavesdropper with a lattice code. The eavesdropper sees 
the sum of these two codes, both taking value in a finite 
group, where the sum is carried under the addition defined 
over the group. It is known that if the jamming signal is 
sampled from a uniform distribution over the group, then the 
sum is independent from the message. 

While these are encouraging steps in showing the impact of 
structured jamming signals, as commented in [15 |, using this 
technique in Gaussian channels is a non-trivial step. In the 
Gaussian channel, also, the eavesdropper receives the sum of 
the signal from the source and the jamming signal. However, 
the addition is over real numbers rather than over a finite 
group. The property of modulus sum is therefore lost and it 
is difficult to measure how much information is leaked to the 
eavesdropper. 

Most lattice codes for power constrained transmission have 
a similar structure to the one used in |fl5l . First, a lattice is 
constructed, which should be a good channel code under the 
noise/interference. Then, to meet the power constraint, the 
lattice, or its shifted version, is intersected with a bounded 
set, called the shaping set, to create a set of lattice points 
with finite average power. The lattice is shifted to make sure 
sufficiently many lattice points fall into the shaping set to 
maintain the codebook size and hence the coding rate ifTBI . 
The decoder at the destination is called a lattice decoder if it 
is only asked to find the most likely lattice point under the 
received signals, and is not aware of shaping set. Because of 



the structured nature of the lattice, a lattice decoder has lower 
complexity compared to the maximum likelihood decoder 
where the knowledge of shaping set is used. Also, under 
the lattice decoder, the introduction of shaping set does not 
pose any additional difficulty to the analysis of decoding 
performance. Commonly used shaping sets include the sphere 
|[T2"1 and the fundamental region of a lattice ifTTl . 

A key observation is that, from the viewpoint of an eaves- 
dropper, the shaping set actually provides useful information, 
since it reduces the set of lattice points the eavesdropper 
needs to consider. The main aim of this work, therefore, is 
to find a shaping set and lattice code construction under 
which the information leaked to the eavesdropper can be 
bounded. This shaping set, as we shall see, turns out to be the 
fundamental region of a "coarse" lattice in a nested lattice 
structure. Under this construction, we show that at most 1 bit 
is leaked to the eavesdropper per channel use. This enables 
us to lower bound the secrecy rate using a technique similar 
to the genie bound from IfTSl . 

To demonstrate the utility of our approach, we then apply 
our technique to two channel models: a Gaussian wiretap 
channel with a cooperative jammer, and a multi-hop line 
network, where a source can communicate a destination only 
through a chain of untrusted relays. In the second case, 
we demonstrate that a non-vanishing positive secrecy rate 
is achievable regardless of the number of hops. 

The following notation is used throughout this work: We 
use H to denote the entropy. £j. is used to denote any 
variable that goes to when n goes to oo. We define 
C(x) = Mog 2 (l + x). \a\ denotes the largest integer less 
than or equal to a. 

II. The Representation Theorem 

In this section, we present a result about lattice codes 
which will be useful in the sequel. 

Let A denote a lattice in 1Z N IfTTl . i.e., a set of points 
which is a group closed under real vector addition. The 
modulus operation x mod A is defined as x mod A = x — 
arg min^gA d(x, y), where d(x, y) is the Euclidean distance 
between x and y. The fundamental region of a lattice V is 
defined as the set {x : x mod A = 0}. It is possible that there 
are more than one lattice points that have the same minimal 
distance to x. Breaking a tie like this is done by properly 
assign the boundary of V IfTTl . 

Let t A and t B be two numbers taken from V. For any set 
A, define 2 A as 2 A = {2x : x £ A}. Then we have: 

{t A + t B :t A ,t B e V} = 2V (1) 

Define A x as A x = {t A + t B + %, t.A, ts £ V}. Then from 
(HJ, we have A x = x + 2V. With this preparation, we are 
ready to prove the following representation theorem: 

Theorem 1: There exists a random integer T, such that 
1 < T < 2 N , and t A +t B is uniquely determined by {T, t A + 
t B mod A}. 

Proof: By definition of the modulus A operation, we 

have 

t A + t B mod A = t A + t B + x, ieA (2) 



The theorem is equivalent to finding the number of possible 
x meeting equation (f2]i for a given t A + t B mod A. 

To do that, we need to know a little more about the struc- 
ture of lattice A. Every point in a lattice, by definition, can be 

N 

represented in the following form |19|: x = ^ a^, Vi £ 

i=l 

R N , ai £ Z. {a,i} is said to be the coordinates of the lattice 
point x under the basis {vi}. 

Based on this representation, we can define the following 
relationship: Consider two points x, y £ A, with coordinates 
{ai} and {bi} respectively. Then we say x ~ y if ai = 
hi mod 2, i = 1...N. It is easy to see the relationship ~ is 
an equivalence relationship. Therefore, it defines a partition 
over A. 

1) Depending on the values of ai — bi mod 2, there are 
2 N sets in this partition. 

2) The sub-lattice 2A is one set in the partition, whose 
members have even coordinates. The remaining 2 N — 1 
sets are its cosets. 

Let Ci denote any one of these cosets or 2A. Then Ci can 
expressed as Ci = 2A + yi, yi £ A. It is easy to verify that 
A x = x + 2V, x £ Ci is a partition of 21Z N + yi, which 
equals TZ N . 

We proceed to use the two partitions derived above: Since 
Ci,i = 1...2 N is a partition of A, (ff]) can be solved by 
considering the following 2 N equations: 

t A + tB mod A = t A + t B + x, x £ Ci (3) 

From (Q~|), this means t A + t B mod A £ x + 2V for some 
x £ Ci. Since x + 2V, x £ Ci is a partition of TZ N , there is 
at most one x £ Ci that meets this requirement. This implies 
for a given t A + ts mod A, and a given coset Ci, (O only 
has one solution for x. Since there are 2 N such equations, 
(ffji has at most 2 N solutions. Hence each t A + ts mod A 
corresponds to at most 2 N points of t A + ts- ■ 
Remark 1: Theorem Q] implies that modulus operation 
looses at most one bit per dimension of information if 
t A ,t B £ V. 

The following crypto lemma is useful and is provided here 
for completeness. 

Lemma 1: lfT5ll Let t A ,ts be two independent random 
variables distributed over the a compact abelian group, ts 
has a uniform distribution, then t A + t.B is independent from 
t A . Here + is the addition over the group. 

In the remainder of the paper, (A,Ai) denotes a nested 
lattice structure where Ai is the coarse lattice. Let V and Vi 
be their respective fundamental regions. We shall use a © b, 
short for a + b mod Ai. Then from Lemma [T] we have the 
following corollary: 

Corollary 1: Let t A £ A n Vi. t B £ An Vi and t B is 
uniformly distributed over A n V\. Let ts = t A ® t B . Then 
ts is independent from t A . 

III. Wiretap Channel with a Cooperative Jammer 

In this section, we demonstrate the use of lattice codes 
for secrecy in the simple model depicted in Figure Q] Nodes 
S,D,E form a wiretap channel where S is the source node, 




Fig. 1. Wiretap Channel with a Cooperative Jammer, CJ 



D is the destination node, E is the eavesdropper. Let the 
average power constraint of node S be P. Now suppose 
that there is another transmitter CJ in the system, also 
with power constraint P, as shown in Figure Q] We assume 
that the interference caused by CJ to node D is either too 
weak or too strong that it can be ignored or removed, and 
consequently there is no link between CJ and D. In this 
model, node CJ may choose to help S by transmitting a 
jamming signal to confuse the eavesdropper E. Below, we 
derive the secrecy rate for this case when the jamming signal 
is chosen from a lattice codebook. 

A. Gaussian Noise 

We first consider the case when Z\ and Z 2 are independent 
Gaussian random variables with zero mean and unit variance. 
In this case, we have the following theorem: 

Theorem 2: A secrecy rate of [C(P) — 1] + is achievable. 
Proof: The codebook is constructed as follows: Let 
(A, Ai) be a properly designed nested lattice structure in 1Z N 
as described in 1171 . The codebook is all the lattice points 
within the set A n Vi. 

Let t A be the lattice point transmitted by node S. Let 
d A be the dithering noise uniformly distributed over Vi . The 
transmitted signal is given by t A ®d A . The receiver receives 
the above signal corrupted by Gaussian noise and tries to 
decode t A . Let the decoding result be t A . Then as shown in 
ifTTl Theorem 5], there exists a sequence of properly designed 
(A, Ai) with increasing dimension, such that 



lim -log a |AnVi|<C(P) 
C(P) = ilog 2 (l + P) 



(4) 

(5) 



and limjv^ooPr^ ^t%)=0. 

The cooperative jammer CJ uses the same codebook as 
node S. Let the lattice point transmitted by CJ be tg and 
the dithering noise be dg. The transmitted signal is given 
by tg © dg. As in ifTTl . we assume that d A is known by 
node S, the legitimate receiver node D and the eavesdropper 
node E. dg is known by node S, and the eavesdropper 
node E. Hence, there is no common randomness between 
the legitimate communicating pairs that is not known by the 
eavesdropper. 

Then the signal received by the eavesdropper can be 
represented as t A © d A + t 



d N 



Z$, where Z$ is 



the Gaussian channel noise over N channel uses. Then we 
have 



H(t%\t 



A 



>d N A +t N g. 



7 N rf N J N \ 
Zj 2 ,a A ,a B ) 



(6) 



TTfj.N\,N , 

>H(t A \t A ( 


Bd A +tg ®dg + Z 2 ,d A ,dg,Z 2 ) 


(7) 


TTfj.N\ j_N f 

=H(t A \t A ( 


B d A +t^ ®d^,d2,d^) 


(8) 


uuN\j.N , 

=H[t A \t A ( 


D US + N £D rl N A N rl N r T\ 
V a A tfc) Lg tf Ug , U A , Ug , 1 ) 


(9) 




e^,<,4,r) 


(10) 




B*£,T) 


(11) 


=H (T\t A Q 


n N g,t N A )+H{t N A \t N A ®t N B )-H{T\t N A i 





>H{t N A \t N A ®t N g 



H(T\t 



t N s) 



(12) 
(13) 

=H{t N A )-H{T\t N A ®t^) (14) 
>H(ti)-H{T) (15) 

In (0, we introduce the N bit information T that will help 
to recover t%®d 1 A f +t B T ® d% from © dj © t% © d% . In 
flU, we use the fact that t A is independent from t A © tg 
based on Corollary [T] 

Let c = ±l(t%;t%(BdZ + tZ®d» + ZF,dZ,d%). 
Then from ( flBI l, since H(T) < N, we have c < 1. 
Therefore, if the message is mapped one-to-one to t A , then 
an equivocation rate of at least C (P) — 1 is achievable under 
a transmission rate of C(P) bits per channel use. 

We note that to obtain perfect secrecy, some additional 
effort is required. First, we define a block of channel uses 
as the N channel uses required to transmit a N dimensional 
lattice point. A perfect secrecy rate of C(P) — 1 can then 
be achieved by coding across multiple blocks: A codeword 
in this case is composed of Q components, each component 
is an N dimensional lattice point sampled from a uniform 
distribution over Vi n A in an i.i.d. fashion. The resulting 
codebook C contains 2L JV< 2- R J codewords with R < C(P). 
Like wiretap codes, the codebook is then randomly binned 
into several bins, where each bin contains 2^ Ar< 3 c J codewords. 
The secret message W is mapped to the bins. The actual 
transmitted codeword is chosen from that bin according to a 
uniform distribution. 

Let Y£"3 denote the signals available to the eavesdropper: 

Y NQ = {t NQ d NQ + t NQ ffi jNQ + d A ®, dg}. 

Then we have 

H(W\Y e NQ ,C) 
=H {W\t N A Q , Y e N Q , C) + H{t N A Q \Y e N Q , C) 
-H(4 Q \W,Y e N Q,C) 



>H(t A Q \Y e NQ ,C)~NQe 



(16) 
(17) 



=H(t1 Q \Y e N Q,C) - H{t N A Q \C) + H{t N A Q \C) - NQe 



-~H(t N A Q \C) - I(t^ Q ;Y e NC i\C) - NQe 



>Hit1Q\c)-J2lK,Y e N \C) 



NQe 



(18) 
(19) 

(20) 



9=1 



H[t N A Q \C 



QNc - NQe = QN(R-c)- NQe 

(21) 

In ( fTTI i. we use Fano's inequality to bound the last term in 
(TToT l. This is because the size of each bin is kept small enough 



such that given W, the eavesdropper can determine t A from 



its received signal Y^®. Using the standard random coding 
argument and ( f2Tb . it can then be shown a secrecy rate of 
C(P) — c is achievable. Since c < 1, this means a secrecy 
rate of at least C(P) — 1 bits per channel use is achievable. 

■ 

Remark 2: It is interesting to compare the secrecy rate 
obtained here with that obtained by cooperative jamming with 
Gaussian noise 1201 . The latter is given by C(P) — C(-p^j). 
limp-,00 C(-pxj-) = 0.5. Therefore there is at most 0.5 bit 
per channel use of loss in secrecy rate at high SNR by using 
a structured code book as the jamming signal. 

B. Non-Gaussian Noise 

The performance analysis in ifTTI requires Gaussian noise. 
This is not always the case, for example, in the presence 
of interference, which is not necessarily Gaussian. For non- 
Gaussian noise, in principle, the analysis in [16] can be used 
instead. On the other hand, in IfTBTl . a sphere is used as the 
shaping set, making it difficult to computing the equivocation 
rate via Theorem [JJ We show below, if the code rate R has 
the form log 2 t,t £ Z + , then a scaled lattice tA of the fine 
lattice A can be used for shaping instead. 

Theorem 3: If Zx^Z^ are i.i.d. continuous random vari- 
ables with differential entropy h(E), such that 2 2h{ - E ^ = 2ne, 
then a secrecy rate of [log 2 ['V^Pj — 1] + is achievable. 

Proof: We need to show that there exists a fine lattice 
A that has a good decoding performance lfl6l Theorem 6], 
and A is close to a sphere in the sense that 

lim h{S) = \\og 2 {2neP') (22) 

N—>oo Z 

where h(S) = log 2 |V|, |V| is the volume of the fundamen- 
tal region of A, and P' = -^jyy J xeV \\x\\ 2 dx. It is shown in 
iBTI that when a lattice is sampled from the lattice ensemble 
defined therein, it is close to a sphere in the sense of (1221 . 
The lattice ensemble is generally called construction A lfl6l . 
whose generation matrices are all matrix of size K x N over 
finite group GF(<j), with q being a prime. The lattice sampled 
from the ensemble is "good" in probability when q, N — ► 00 
and K grows faster than log 2 N ED (25)-(28)]. Note that this 
property of "goodness" is invariant under scaling. Therefore, 
we can scale the lattice so that the volume of its fundamental 
region remains fixed when its dimension N — > 00. This gives 
us a sequence of lattice ensembles that meet the condition 
of CCS Lemma 1]: (1) N -> 00 (2) q -> 00. (3) Each lattice 
ensemble of a given dimension is balanced 1161 . This means 
when N — > 00, at least 3/4 of the lattice ensemble is good for 
channel coding lfl3l Lemma 1]. The lattice decoder will have 
a positive decoding error exponent as long as |V| > 2 Nh ( E \ 
Combined, this means there must exist a lattice A* that 
is close to a sphere and is a good channel code at the 
same time. Hence we have -h log 2 | V| — > h log 2 (2neP') as 
A" — > 00. Since we assume h(E) = | log 2 (27re) and require 
|V| > 2 Nh ( E \ this means as long as P' > 1, the decoding 
error will decrease exponentially when A" — > 00. 

Now pick the shaping set to be the fundamental region 
of tA*, t G Z+. Then the code rate R = log 2 (t) Q3. With 



the dithering and modulus operation from lfl7ll . the average 
power of the transmitted signal per dimension is t 2 P' . Note 
that the modulus operation at the destination, required in 
order to remove the dithering noise, may distort the additive 
channel noise. However, the decoding error event, defined as 
the noise pushing a lattice codeword into the set of typical 
noise sequence centered on a different lattice point IfTBTl . 
remains identical. Therefore, the decoding error exponent 
is the same. Hence we have P' > 1 and t 2 P' < P. The 
largest possible t is LV^PJ, with the rate being log 2 (|_\/Pj ). 
With similar arguments as in Theorem [2] we conclude that a 
secrecy rate of [log 2 ([v / Pj) — 1] + is achievable. 

■ 

IV. Multi-hop Line Network with Untrusted 
Relays 

A. System Model 

In this section, we examine a more complicated communi- 
cation scenario, as shown in Figure|2] The source has to com- 
municate over K — 1 hops (K > 3) to reach the destination. 
Yet the intermediate relaying nodes are untrusted and need to 
be prevented from decoding the source information. Under 
this model, we will show that, using Theorem Q] with lattice 
codes for source transmission and jamming signals and an 
appropriate transmission schedule, an end-to-end secrecy rate 
that is independent of the number of untrusted relay nodes 
is achievable. We assume nodes can not receive and transmit 
signals simultaneously. We assume that each node can only 
communicate to its two neighbors, one on each side. Let Yi 
and Xi be the received and transmitted signal of the ith node 
respectively. Then they are related as Yi = Xi-x+Xi+x + Zi, 
where Zi are zero mean Gaussian random variables with unit 
variance, and are independent from each other. Each node has 

Fig. 2. A Line Network with 3 Un-trusted Relays 

the same average power constraint: — Y^k—i E [A^i(fc) 2 ] < P 
where n is the total number of channel uses. The channel 
gains are normalized for simplicity. 

We consider the case where there is an eavesdropper 
residing at each relay node and these eavesdroppers are not 
cooperating. This also addresses the scenario where there is 
one eavesdropper, but the eavesdropper may appear at any 
one relay node that is unknown a priori. In either case, we 
need secrecy from all relays and the secrecy constraints for 
the K relay nodes are expressed as lim -H(W\YP) = 

n—>oo 71 

lim ±H(W),i = I...K. 

B. Signaling Scheme 

Because all nodes are half duplex, a schedule is necessary 
to control when a node should talk. The node schedule is 
best represented by the acyclic directional graph as shown 
in Figure [3] The columns in Figure [3] indicate the nodes and 
the rows in Figure [3] indicate the phases. The length of a 
phase is the number of channel uses required to transmit a 



lattice point, which equals the dimension of the lattice. A 
node in a row has an outgoing edge if it transmits during 
a phase. The node in that row has an incoming edge if it 
can hear signals during the previous phase. It is understood, 
though not shown in the figure, that the signal received by 
the node is a superposition of the signals over all incoming 
edges corrupted by the additive Gaussian noise. 

A number of consecutive phases is called one block, as 
shown in Figure [3] The boundary of a block is shown by the 
dotted line in Figure [3] The data transmission is carried over 
M blocks. 




Fig. 3. One Block of Channel Uses 

Again the nested lattice code (A,Ai) from iflOl is used 
within each block. The codebook is constructed in the same 
fashion as in Section Hill 

1) The Source Node: The input to the channel by the 
source has the form t N © J N © d . Here d N is the dithering 
noise which is uniformly distributed over Vi. t and J N are 
determined as follows: If it is the first time the source node 
transmits during this block, t is the origin. J N is picked 
from the lattice points in An Vi under a uniform distribution. 
Otherwise, t N is picked by the encoder. J N is the lattice 
point decoded from the jamming signal the source received 
during the previous phase. This design is not essential but it 
brings some uniformness in the form of received signals and 
simplifies explanation. 

2) The Relay Node: As this signal propagates toward the 
destination, each relay node, when it is its turn, sends a 
jamming signal in the form of t£ +d^ mod A, k = 2...K—1, 



where K is the number of nodes. Subscript k denotes the 
node index which transmit this signal. If this is the first 
time the relay transmits during this block, then is drawn 
from a uniform distribution over An Vi, and all previous 
received signals are ignored. Otherwise, t% is computed from 
the signal it received during the previous phase. This will 
be clarified in the sequel, d^f again is the dithering noise 
uniformly distributed over Vi. 

The signal received by the relay within a block can be 
categorized into the following three cases. Let z N denote the 
Gaussian channel noise. 

1) If this is the first time the relay receives signals during 
this block, then it has the form (t^®d^) + z N . It only 
contains interference from its left neighbor. 

2) If this is the last time the relay receives signals during 
this block, then it has the form (tg ®dg) + z N . It only 
contains interference from its right neighbor. 

3) Otherwise it has the form = (t% d%) + (t% 
d%) + z N . 

Here t%, tg are lattice points, and d^, dg are dithering 
noises. Following reference 1101 . if the lattice is properly 
designed and the cardinality of the set An Vi is properly 
chosen, then for case (3), the relay, with the knowledge of 
d^,dg, will be able to decode rj[ © tg. For case (1) and 
(2), the relay will be able to decode ty[ and tg respectively. 
Otherwise, we say that a decoding error has occurred at the 
relay node. 

The transmitted signal at the relay node is then computed 
as follows: 

x N =t%®t B r ® (-x' N ) © d% (23) 

Here x' N is the lattice point contained in the jamming signal 
transmitted by this relay node during the previous phase. — is 
the inverse operation defined over the group Vi n A. fr^ © tg 
are decoded from the signal it received during the previous 
phase. 

In Figure [3] we labeled the lattice points transmitted over 
some edges. For clarity we omitted the superscript N . The 
+ signs in the figure are all modulus operations. The reason 
why we have (— x' N ) in (l23l is now apparent: it leads to 
a simple expression for the signal as it propagates from the 
relay to the destination. 

3) The Destination: As shown in Figure [3] the destination 
behaves identically to a relay node when it computes its 
jamming signal. 

It is also clear from Figure [3] that the destination will be 
able to decode the data from the source. This is because 
the lattice point contained in the signal received by the 
destination has the form t N © J N , where t N is the lattice 
point determined by the transmitted data, and J N is the lattice 
point in the jamming signal known by the destination. 

C. A Lower Bound to the Secrecy Rate 

Suppose the source transmits Q + 1 times within a block. 
Then each relay node receives Q + 2 batches of signals within 
the block. An example with Q = 2 is shown in Figure [3] 
Given the inputs from the source of the current block, the 



signals received by the relay node are independent from 
the signals it received during any other block. Therefore, 
if a block of channel uses is viewed as one meta-channel 
use, with the source input as the channel input and the 
signal received by the relay as the channel output, then the 
effective channel is memoryless. Each relay node has the 



The relay node 
under consideration 




Fig. 4. Notations for Lattice Points contained in Signals, Q = 2 

following side information regarding the source inputs within 
one block: 

1) Q + 2 batches of received signals. 

2) All the dithering noises {di}. 

3) Signals transmitted from the relay node during this 
block. Note that only the first batch of signals it trans- 
mitted may provide information because all subsequent 
transmitted signals are computed from received signals 
and dithering noises. 

Let W be the secret message transmitted over M blocks. 
Following the notation in Figure [4] the equivocation with 
respect to the relay node is given by: 

1 ;H(W\( X ^®d™) + zr,dl M 



Ho = 
" NM 

NM iNM 
ai i a /3(i-l)'* 



d: 



r f NM a 

: 2...Q+1 



a 0(i-l)> + Z i ' 



(t NM ffid NM \< 7 NM,NM ,NM ,NM ) 
\ l D(Q+l) * a /3(Q+l)) + z Q+l> a p(Q+l)' t Bl > "61 I \ z ^> 

Define the block error probability as 

P e = Pr(3i e {2...Q + 1}, s.t.x Ai is in error, 

or is in error, or tp,Q +1 \ is in error.) (25) 



where x 



Ai is the part of x Ai 



Similar notations are used for 



1 that is within one block. 

Given 



the signaling scheme presented in section IIV-BI and IfTTl 
Theorem 2], the probability of decoding error at each relay 
node goes to zero as TV — > oo. Let P e (i, k) be the probability 
of decoding error at relay node i during phase k. Then P e 
is related to P e {i, k) as P e < 1 — Y\ i k (l — P e (i, k)), where 



the subscript in product includes the indices of all the relay 
node and the indices of the phases in this block. 

For any given block length Q, we have limAr_»oo P e = 0. 
Note that P e is just a function of N and Q. Because there 
are only finite number of relay nodes, this convergence is 
uniform over all relay nodes. 

Let the equivocation under error free decoding be 

TltXXrU NM „ jiVM\ . NM iNM 

-H(W\{x A1 ®d al ) + z 1 ,d al 

(TNM ffi jNM \ , NM 
) + \ l D(i-l) W a p{i-l)) + z i ) 

f 1 



Ho = 
" NM 

(xT © d»» 



9 



jNM 

HQ+i) ( 
where x A , M 



iNM 



,NM iNM 



,t 



equals the value x Ai 



NM jNM 



) (26) 



decoding. and t£g +1) 



jNM ,NM 

a ai i a f5 

(TNM ffi .iv M 

\ l D(Q+l) w a f3(Q+l) ) + Z Q+1 ' a /3(Q+l) ^Bl I "61 

takes with error free 
are defined in a similar 
fashion. Then we have the following lemma: 

Lemma 2: For a given Q, H2 + E2 > H2 > #2 — £1 where 
e x ,i -> as iV,M-» 00. 

Proof: Let c 1 , c? denote the part of signals received by 
the relay node within the jth block. More specifically, they 
have the following form: 

v = {«iU)®dZ(m 

(*Vi)(i) ® + = 2-.Q + 1} (27) 

c J = {^l(j)®d^U)) + 



© 4(i-i) (•?')) + *iti),i = 2-Q + 1} (28) 
In this notation, we exclude the first and the last batch of 
received signals. The first batch of received signals does 
not undergo any decoding operation. For the last batch of 
received signals we have the following notation: 

j-N / -\ ~ 7 TV , -w , N 



f = (*S(Q+1)CJ) © 4(Q+i)(j)) + 



(29) 
(30) 



f = (*S(Q + i)(i) © 4(q+i)0')) + 

The block index (j) will be omitted in the following discus- 
sion for clarity. 

We first prove that c? — & is a discrete random variable 
with a finite support. According to the notation of (1281 . c? 
has Q components. Each component can be expressed as 



' dl) c 



4 



'•aij 
,N 



For the first line of OTb we have 



™iv 

^JV 



j/V^ 



„JV 



© ^ai) 



u, oa 
x Ai 



„N 



r N 



jN 



(31) 

(32) 
(33) 
(34) 



where x^ ,x% belong to the coarse lattice Ai. Applying 
Theorem Q] we note that x 1 ^ and each has at most 2 N 
possible solutions. x Ai and x Ai each take j|Vi n A| possible 
values. Let R = -ir log 2 ||Vi H A||. Then d32l takes at most 
227V(R+i) p OSS ibi e values. Similarly, we can prove that the 
second line of OTb has at most 2 2N ( R+1 *> possible values as 
well. Therefore c J — c? takes at most 2 AN ^ R+1 ^ possible 
values. Therefore H (c> - c j ) < ANQ(R + 1). Similarly, it 



can be shown that f — f has at most 2N(R + 1) solutions. 
This means that 

H(c> - &>,f j - f) < (4Q + 2)N(R + 1) (35) 

Let c = {cP}, c = {&}, f = {f} and / = {p} j = 1...M. 
Let b denote the remaining conditioning terms in H 2 - Let 
denote the random variable cJ ^ & or fi ^ p . Then with 
probability P e that E j = 1. Otherwise E j = 0. Let W be 
the message transmitted over the M blocks. Then we have 

H(W\b,c,f) 

>H(W\b,c,c,f,f) (36) 

=H(W\b,c,f,c-c,f-f) (37) 
=H(W\b, c, f) + H(c - c, / - f\W, b, c, /) 

-H(c-cJ- f\b,cj) (38) 

>H(W\b,c,f)-H(c-c,f-f) (39) 

M 



>H{W\b, c,f)-J2 - &J j - P) (40) 

i=i 

=H(W\b, c,f)-J2 H(J - c\P - fi,E?) (41) 

3=1 
M 

>H(W\b,c,f)-Y,H(E j ) 

(42) 



3=1 



-J2 F < Ei = l)Z(c? -&,P -P) 
J'=l 

>iJ(M^|&, c, p-M - MP e (4Q + 2)N(R + 1) (43) 

By dividing NM on both sides and letting N, M — * oo, and 
£i = 1/JV + P e (4Q + 2_)(i? + 1) we get H 2 > H 2 - s x . 
Similarly we can prove Hi > H2 — £2- ■ 
Remark 3: Lemma |2] says that if a particular equivocation 
value is achievable with regard to one relay node, when all 
the other relay nodes do error free decoding, then the same 
equivocation value is achievable when other relay nodes do 
decode and forward which is only error free in asymptotic 
sense. 

Lemma 3: H2 is the same for all relay nodes. 

Proof: Lemma follows because relay nodes receive 
statistically equivalent signals if there are no decoding errors. 
For the fcth relay node, as shown by the edge labels in 
Figure [3] the condition term of H2 in d26b is related to t 
as follows: 



NM 
3 



JVM 
C A1 



-A2 



J, 



NM 
fc-2 



•k-1 



-NM 



x 'a'(q+i) — *0 



NM 



.NM 



iNM 



J 



tNM 
L D1 



T NM 



(44) 
(45) 
(46) 

£&- a (47) 
(48) 



tNM 
l D2 
TNM 
l D3 



= t 
= t 



NM 


NM 



J, 



NM 
k+1 

NM r 



J, 



NM 
k+2 



NM 



,NM 



D(Q+1) 
NM 



.NM 
t 1 



.NM 
l Q-l 



J, 



NM 
k+Q 



Bl 



J, 



NM 
k-1 



(49) 
(50) 

(51) 
(52) 

Given the lattice points transmitted by the source tj , the 
joint distribution of the side information for any relay node 
is the same. Hence we have the lemma. ■ 
With these preparation, we are now ready to present the 
following achievable rate. 

Theorem 4: For any e > 0, a secrecy rate of at least 
0.5(C(2P — 0.5) — 1) — e bits per channel use is achievable 
regardless of the number of hops. 

Proof: According to Lemma [3] it suffices to design 
the coding scheme based on one relay node. We focus on 
one block of channel uses as shown in Figure [5] Let V(j) 
to denote all the side information available to the relay 
node within the jth block. We start by lower bounding 
H(tQ Q \V(j)) under ideal error free decoding, where t$ 
are the lattice points picked by the encoder at the source node 
as described in Section lrV-Bl within this block. H(t^ Q \V(j)) 
equals 



daii ^/9(»-l)5* — 2...Q + 1, tg 1: d^x, 



(53) 



Comparing (l53l with the condition terms in (l26b . we see 
that we have removed the first batch and the last batch of 
received signals during a block from the condition terms 
because they are independent from everything else. The last 
batch of received signals contains the lattice point of the 
most recent jamming signal observable by the relay node. Its 
independence follows from Lemma [T] 

We then assume that the eavesdropper residing at the relay 
node knows the channel noise. This means d53l l can be lower 
bounded by: 



N 

D(i-l) 



d% i ,d% (i _ 1) ,i = 2...Q+l,t% 1 ,d&) (54) 

Next, we invoke Theorem Q] Equation d54l i can be lower 
bounded by: 



t 



N 

D(i-l) 



^j9(»-l)>^»' 



dan d%i_D,i — 2...Q + 1, tgj, dft 



N 



(55) 



where Tj can be represented with N bits. Using the similar 
argument as in d9l-(fT3ll, ( T55T l is lower bounded by: 



^ai)^(t-l))i=2...Q+l i*Bl)^6l) _ H(Ti,i=2...Q+l ) (56) 
=H(tQ Q \x% © f^(i_i),i=2...Q+l - H(Ti,i=2...Q+l ) 

(57) 

It turns out that in the first term in d57l i. the conditional 
variables are all independent from t$ . This is because 



^D(i-i) contams which is a new lattice point not 



contained in previous or ^a? i < *■ The new lattice 

point is uniformly distributed over Vi n A. Therefore, from 
Lemma [T] Xj[i ( 
( f57l i equals 



is independent from . Therefore 



- i?(T i)i=2 ... 0+1 ) 



Define 



(58) 



(59) 



Then from (l58l . we have c S (0, 1). 

To achieve perfect secrecy, a similar argument of coding 
across different blocks as the one in Section [HI] can be used. 
A codebook with rate R and size 2 l MN Q R l that spans over 
M blocks is constructed as follows: Each codeword is a 
length MQ sequence. Each component of the sequence is 
an A^-dimensional lattice point sampled in an i.i.d fashion 
from the uniform distribution over Vi n A. The codebook is 
then randomly binned into several bins. Each bin contains 
2\_mnqc\ coc [ eworc i Si with c given by (|59l . Denote the 
codebook with C. 

The transmitted codeword is determined as follows: Con- 
sider a message set {W}, whose size equals the number of 
the bins. The message is mapped to the bins in a one-to-one 
fashion. The actual transmitted codeword is then selected 
from the bin according to a uniform distribution. Let this 
codeword be u MN ®. Let V = {V(j),j = 1...M}. Then we 
have: 

H(W\V,C) (60) 
=H(W\u MN Q,V,C) +H(u MN Q\V 1 C) 

- H {u MNQ \W 1 V 1 C) (61) 
>H (u MNQ \V, C) - MNQe (62) 
=H (u MN( 3\C) - I (u MN Q; V\C) ~ MNQe (63) 

M 

>H (u MNQ \C) -J2 1 (u MNQ U); V(j)) - MNQe (64) 

3=1 

=H (u MNQ \C) - MNQe - MNQe (65) 



follows from Fano's inequality and the size of the bin 
is picked according to the rate of information leaked to 
the eavesdropper under the same input distribution used to 
sample the codebook. d64l i follows from C — > u MN ® — > V 
being a Markov chain. Divide ( f6Qb and d65l l by M NQ and let 
M — > oo, we have e — > and limA/_ +00 mnq H(W\V,C) = 



- t H(W). Therefore a secrecy rate of R 



lim M ^oo M7VQ J 

bits per channel use is achieved. According to ifTUl , R can 
be arbitrarily close to C(P — 0.5) by making N — > oo, where 
P is the average power per channel use spent to transmit a 
lattice point. For a given node, during 2Q + 3 phases, it is 
active in Q + 1 phases. Since c e [0, 1], a secrecy rate of 

' 2Q+3 p 



Q+i 



i+3(C(^ftpr-P - 0.5) - 1) is then achievable by letting 
M — > oo. Taking the limit Q — > oo, we have the theorem. ■ 

V. Conclusion 

Lattice codes were shown recently as a useful technique to 
prove information theoretic results. In this work, we showed 



that lattice codes are also useful to prove secrecy results. 
This was done by showing that the equivocation rate could 
be bounded if the shaping set and the "fine" lattice forms 
a nested lattice structure. With this new tool, we computed 
the secrecy rate for two models: (1) a wiretap channel with 
a cooperative jammer, (2) a multi-hop line network with 
untrusted relays. For the second model, we have shown that 
a coding scheme can be designed to support a non-vanishing 
secrecy rate regardless of the number of hops. 
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